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In a recent paper, [Phys. Rev. A 65, 052326 (2002)], Mihara presented several cryptographic 
protocols that were claimed to be quantum mechanical in nature. In this comment it is pointed out 
that these protocols can be described in purely classical terms. Hence, the security of these schemes 
does not rely on the usage of entanglement or any other quantum mechanical property. 
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The cryptographic protocols presented in Q use entan- 
gled quantum states and are called "quantum password 
schemes" , "quantum identification schemes" and "quan- 
tum message authentication schemes" , thus suggesting 
that the security of these procedures relies on the prop- 
erties typical of quantum information. In this Comment 
we will show that this suggestion is incorrect as these pro- 
tocols can be described in purely classical terms. More 
specifically, the protocols in only use the classical cor- 
relations between the bits of the distributed quantum 
states. All procedures are, in fact, only variations of 
the traditional Vernam cipher scheme, which has been 
known since the early 1900s 0. 

The two-party "quantum password" scheme of uses 
n copies of the bipartite, entangled state \ipi) := (|0,0) + 
|1, l))/v2- The password is an n-bit string p 6 {0, 1}™, 
and the goal of the scheme is to let one party (the system) 
verify that the other party (the user) knows p, under the 
requirement that this verification does not makep public. 
This is achieved by the following steps. First, the system 
selects a random n-bit string r 6 {0, 1}". Second, for all 
1 < i < n, if Ti pi then the system applies the classical 
Not operation, 



X 



1 

1 



to its bit of the entangled state If r*j — Pi, then 

the \ipi) remains unchanged. Simultaneously, the sender 
applies X to her part of \ipi) for all i with pi = 1, while 
she does not change the states for which pi — 0. (As 
aresult, the states have changed to (\ri®Pi,Pi) + \l® 
ri®Pi,l®Pi))/V2.) Third, the user measures her parts of 
the entangled states in the computational basis {|0), |1)}, 
and sends these outcomes u\, . . . , u n to the system. The 
system measures his part of the entangled states in the 
computational basis as well, yielding the bits s±, . . . , s n . 
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Finally, the password is verified by the system who checks 
the identity r.i — Si® u% for all i. 

First of all, it should be noted that the usage of the 
random bits rj in the above protocol is unnecessary. The 
scheme works equally well if the system chooses r to be 
the string 0---0. More important, though, is the fact 
that the same scheme can also be implemented when the 
parties substitute the entangled states with classi- 
cally correlated states Pl := |(]00><00| + |H)(H|). Be- 
cause the protocol uses only the classical Not operation 
and measurements in the computational basis, it is easily 
verified that this substitution gives a completely classical 
process that does not differ from the just described proce- 
dure. This shows that the security of the "quantum pass- 
word" scheme does not rely on the quantum mechanical 
properties of the entangled states \ipi), but rather on the 
classical, shared randomness that these states exhibit. 

In similar vein, one can recast the "multiparty quan- 
tum password" scheme of Q into a classical procedure 
that uses classically correlated multipartite states. The 
essential ingredients of the scheme in pj are: m-qubit 
states \(f>) := (|0, . . . , 0) + |1, . . . , the Hadamard 

transform 
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the phase changing operation 



Z := 
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and measurements in the computational basis {|0), |1)}. 
To see that this scheme is equivalent with a classical pro- 
cedure, it is helpful to consider it in the Hadamard basis 
with |0) := H\0) = (|0) + \l))/y/2 and |1) := H\l) = 
(|0) — |l))/v2- Note that the phase changing Z opera- 
tion equals the classical Not operation X in this basis: 
■ Z ■ H = X, which allows us to use the notation 
X = Z. Furthermore, we have for the initial entangled 
state, 
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which is a uniform superposition of all bit-strings 
y £ {0, l} m with even parity. In this alterna- 
tive basis, the multipartite password scheme of 
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can be expressed as a prot ocol that uses the state 
(T l(B y=o\yi>--->y™))/V2 S=T, the Not transform 1 

(with X : |0) i— > |1) and X : |1) i— > |0)), and measure- 
ments in the basis {|0),|1)} (which equal the combina- 
tion of the Hadamard transform, followed by a standard 
measurement, which is used in the article). As with the 
two-partite password scheme, we see by this limited set 
of operations that the protocol relies only on the clas- 
sical correlations between the bits, only now it uses the 
Hadamard basis instead of the computational basis. As 
a result, we can again replace the entangled states \tf>) by 
classically correlated states 

P := ^2 \VU • ■ ■ ,Vm){Vi, ■ ■ ■ ,Vm\, 

Ittffl— ffiym=o 

without changing the cryptographic properties of the 
password scheme. 

The "identification" and "authentication schemes" 
that are described in pj use states and operations that 
are identical to the ones of the password scheme discussed 
above. Consequently, all of them can be re-expressed 
with classical correlated states, and none of them thus 



qualify to be called "quantum schemes" . 

In 1919, Gilbert Vernam patented^ the one-time pad 
encryption protocol where two parties use a shared, se- 
cret, random string r±, ...,r n to transmit a secret mes- 
sage mi , . . . , m n by broadcasting publicly the scrambled 
string mi r 1; . . . , m n r n . Thirty years later, Claude 
Shannon proved the security of this Vernam cipher in 
a mathematical rigorous way Q. The recent article pj 
by Mihara described, essentially, this same classical pro- 
cedure. Both procedures require the parties to securely 
share correlated information — classical bits in the case of 
the Vernam cipher and, seemingly, quantum bits for the 
implementation of Mihara's protocol. It is true that the 
cited procedure of Lo and Chau 0] gives an uncondition- 
ally secure way of distributing these correlations between 
the separated parties and it also true that this task does 
not seem to be possible classically. But it would be incor- 
rect to infer from this that the protocol of Mihara itself 
is quantum mechanical as well. Rather, one has to con- 
clude that it is only the distribution of correlations that 
requires the use of quantum mechanics, but not the usage 
of these correlations as described in Mihara's article. 
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